What is data residency?
A requirement that certain data physically stay within a specific country or region, met by choosing where a database runs.
Data residency — Data residency is the requirement that certain data be stored and processed within a specific country or region, driven by law, contract or policy. It is met by choosing where the customer's database physically runs.
Why it matters
Data residency rules say that certain data has to be stored and processed within a particular country or region. Not simply accessible from there. The rule can come from a law that applies to the type of data involved. Or a contract with a customer who specified it. Or an internal policy a company holds itself to. Meeting it is mostly a matter of hosting choice. Pick a region for the database, and confirm nothing in the handling path routes data outside that boundary along the way.
The part that catches vendors and customers off guard is scope. A vendor advertising an "EU option" or a regional setup is usually describing where the primary database lives. That leaves open questions about backups, log storage, and any AI step that might send data to a model provider hosted elsewhere. Each of those is a separate data flow. Each can quietly cross the boundary a customer assumed was closed, while the primary database stays exactly where it should. Confirming residency for a system means asking about each of these paths one by one, not only the database's home region.
How data residency is met
- 1
Identify the residency rule
Determine which law, contract or policy sets the boundary.
- 2
Choose the region for the primary database
The customer's data is provisioned in a database located in that region.
- 3
Check backup locations
Confirm backups are stored within the same boundary, not a default global location.
- 4
Check log and processing paths
Confirm logs and any external processing, including AI calls, stay within scope.
- 5
Document the boundary
Record which systems and paths are covered, for review or audit later.
The mistake to watch for
Questions
- How is data residency different from data sovereignty?
- Data residency is about the physical location where data is stored and processed. Data sovereignty goes further. It concerns which country's laws govern that data wherever it sits, which can matter even when residency rules are met.
- Does choosing a regional database satisfy data residency on its own?
- Not necessarily. Backups, logs and any step that sends data elsewhere, such as a call to an AI provider, are separate paths. Each needs checking against the same boundary.
- Who typically requires data residency?
- Rules can come from national or regional law covering specific data types, from a customer contract that specifies a location, or from a company's own internal policy. Each source can set a different boundary.